An S3 bucket must be readable by ANY principal in your AWS Organization — but absolutely nothing outside it — without listing account IDs. Which condition achieves this?
A.aws:PrincipalArn listing every account's root
Enumerating accounts breaks as the org grows.
B.aws:PrincipalOrgID equals your organization ID
Correct. One condition, org-wide scope.
C.An SCP on the bucket
SCPs don't apply to resource-based policies.
D.aws:SourceAccount
Different condition — source account, not org.
Why this answer
aws:PrincipalOrgID matches any principal belonging to your org — the scalable way to express 'inside my organization' in resource policies. aws:SourceAccount refers to the account making the call, not org membership; SCPs govern IAM, not resource policies.
Correct answer: B · Last reviewed 2026-11-04
Official AWS references
Practice this interactively
Answer without seeing the solution first in the IAM Deep Dive practice session.
Practice IAM Deep Dive